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Why GAO Did This Study 

Wastewater facilities provide 
essential services to residential, 
commercial, and industrial users, 
yet they may possess certain 
characteristics that terrorists could 
exploit to impair the wastewater 
treatment process or to damage 
surrounding infrastructure. For 
example, large underground 
collector sewers could be accessed 
by terrorists for purposes of 
placing destructive devices beneath 
buildings or city streets. 

GAO was asked to determine (1) 
what federal statutory authorities 
and directives govern the 
protection of wastewater treatment 
facilities from terrorist attack, (2) 
what steps critical wastewater 
facilities have taken since the 
terrorist attacks of September 11, 
2001, (9/11) to ensure that potential 
vulnerabilities are addressed, and 
(3) what steps the Environmental 
Protection Agency (EPA) and the 
Department of Homeland Security 
(DHS) have taken to help these 
facilities in their efforts to address 
such vulnerabilities. 



What GAO Recommends 



GAO is recommending that EPA 
work with DHS to identify areas 
where the WaterlSAC and HSIN 
could be better coordinated, 
focusing on (1) how duplications 
and overlap could be addressed, 
and (2) how water systems' access 
to critical information could be 
improved. GAO also recommends 
that EPA help identify time frames 
to complete these tasks. EPA and 
DHS generally agreed with the 
report. 

www.gao.gov/cgi-bin/getrpt7GAO-06-390. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact John 
Stephenson at (202) 512-3841 or 
stephensonj @ gao.gov. 



What GAO Found 

Federal law does not address wastewater security as comprehensively as it 
does drinking water security. For example, the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002 required drinking 
water facilities serving populations greater than 3,300 to complete 
vulnerability assessments, but no such requirement exists for wastewater 
facilities. While federal law governing wastewater security is limited, 
Homeland Security Presidential Directive 7 designated EPA as the lead 
agency to oversee the security of the water sector, including both drinking 
water and wastewater. The directive tasked EPA with several 
responsibilities, including the development of mechanisms for information 
sharing and analysis within the water sector. 

Our survey of over 200 of the nation's large wastewater facilities shows that 
many have made security improvements since 9/11. Most facilities indicated 
they have completed, have under way, or plan to complete some type of 
security assessment. Similarly, more than half of responding facilities 
indicated they did not use potentially dangerous gaseous chlorine as a 
wastewater disinfectant. Survey responses show that other security 
measures taken after 9/11 have generally focused on controlling access to 
the treatment plant through improvements in visual surveillance, security 
lighting, and employee and visitor identification. Little effort, however, has 
been made to address collection system vulnerabilities, as many facilities 
cited the technical complexity and expense involved in securing collection 
systems that cover large areas and have many access points. Others 
reported that taking other measures, such as converting from gaseous 
chlorine, took priority over collection system protections. 

While EPA and DHS have initiatives to address wastewater facility security, 
efforts to provide critical and threat-related information would benefit from 
closer coordination. EPA and DHS fund multiple information services 
designed to communicate information to the water sector — specifically, EPA 
funds the Water Information Sharing and Analysis Center (WaterlSAC) and 
its Water Security Channel, while DHS funds the Homeland Security 
Information Network (HSIN). EPA, DHS, and other industry experts are 
concerned that these multiple information services may overlap and produce 
inefficiencies. For example, a substantial part of the $2 million annual grant 
EPA uses to fund the WaterlSAC is dedicated to purchasing computer 
services likely available through DHS and HSIN at no cost. A Water Sector 
Coordinating Council was established by the water sector to help determine 
the appropriate relationship among these information services. A 
preliminary review is under way to examine options for improving 
coordination between the WaterlSAC, the Water Security Channel, and 
HSIN; however, the scope and time frame for completion of this review is 
unclear. 
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United States Government Accountability Office 
Washington, D.C. 20548 



March 31, 2006 

The Honorable James M. Inhofe 
Chairman 

Committee on Environment and Public Works 
United States Senate 

Dear Mr. Chairman: 

Wastewater facilities in the United States provide essential services to 
residential, commercial, and industrial users by collecting and treating 
wastewater and discharging treated effluent into receiving waters. These 
facilities may also provide opportunities for terrorists to either impair the 
wastewater treatment process or damage surrounding communities and 
infrastructure. For example, damage to a wastewater facility or collection 
system could prevent water from being treated, impacting downriver water 
intakes. Destroying tanks that hold large amounts of chemicals at 
treatment plants could release toxic chemical agents, such as gaseous 
chlorine, that can be deadly if inhaled and, at lower doses, could burn eyes 
and skin and inflame the lungs. Large underground collector sewers could 
be accessed by terrorist groups for purposes of placing destructive devices 
beneath buildings or city streets. 

In January 2005, we reported the views of nationally recognized experts on 
key issues concerning wastewater security. 1 The five assets experts 
considered most vulnerable included (1) the collection systems' network of 
sewer lines used to move wastewater away from its point of origination to 
the treatment plant; (2) treatment chemicals, such as gaseous chlorine, 
used to disinfect wastewater; (3) key components of the wastewater 
treatment plant, such as its headworks, where raw sewage first enters the 
plant; (4) automated control systems that control many vital operations, 
such as the amount of chlorine needed for disinfection; and (5) pumping 
stations along the collection system that lift or pump wastewater to the 
treatment plant. The experts noted that security-enhancing activities that 
most warrant federal support include replacing gaseous chemicals used in 
wastewater treatment with less hazardous alternatives; improving local, 
state, and regional collaboration efforts; and completing vulnerability 
assessments for individual wastewater systems. When asked how federal 



'GAO, Wastewater Facilities: Experts' Views on How Federal Funds Should Be Spent to 
Improve Security, GAO-05-165 (Washington, D.C: Jan. 31, 2005). 
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wastewater security funds should be allocated among potential recipients, 
the vast majority of experts suggested that wastewater utilities serving 
critical infrastructure (e.g., public health institutions, government, 
commercial, and industrial centers) should be given the highest priority. 
Other recipients warranting highest priority included utilities using large 
quantities of gaseous chemicals and utilities serving areas with large 
populations. 

As a follow-on to that review, this report examines: (1) what federal 
statutory authorities and directives govern the protection of wastewater 
treatment facilities from terrorist attack, (2) what steps critical wastewater 
treatment facilities have taken since the terrorist attacks of September 11, 
2001, (hereafter referred to as "9/11") to ensure that potential 
vulnerabilities are addressed, and (3) what steps the Environmental 
Protection Agency (EPA) and the Department of Homeland Security (DHS) 
have taken to help these facilities in their efforts to address such 
vulnerabilities. 

To identify federal statutory authorities and directives that govern 
protection of wastewater treatment facilities, we reviewed applicable laws; 
Homeland Security Presidential Directives; and EPA and DHS policies, 
guidance, and regulations related to wastewater security. To determine 
what steps critical wastewater treatment facilities have taken since 9/11 to 
ensure that potential vulnerabilities are addressed, we conducted a Web- 
based survey of the nation's publicly-owned treatment works (POTWs) that 
serve residential populations of 100,000 or greater. Together, these facilities 
provide wastewater service to approximately 36 percent of the U.S. 
population served by POTWs. We received an 82 percent response rate to 
the survey. To determine what steps EPA and DHS have taken to help these 
facilities in their efforts to address such vulnerabilities, we reviewed 
relevant EPA and DHS guidance and other documents, and interviewed 
agency personnel. We also interviewed state and local officials with 
oversight for wastewater treatment operations and security. Information 
about federal efforts to enhance wastewater security from the perspective 
of wastewater treatment facilities was provided to us through our Web- 
based survey. We conducted our work between May 2005 and February 
2006 in accordance with generally accepted government auditing 
standards. See appendix I for a more detailed discussion of our scope and 
methodology. 
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RGSllltS in Brief Federal law does not address wastewater security as comprehensively as it 

does drinking water security. In particular, wastewater facilities are not 
required by law to complete vulnerability assessments. This stands in 
contrast to the requirements for drinking water utilities in the Public Health 
Security and Bioterrorism Preparedness and Response Act of 2002 (the 
Bioterrorism Act), 2 which required drinking water utilities serving 
populations greater than 3,300 to complete vulnerability assessments by 
June 2004. The Clean Air Act does require wastewater facilities using more 
than 2,500 pounds of gaseous chlorine to submit to EPA a risk management 
plan that lays out accident prevention and emergency response activities. 
Also, under EPA guidance, the Clean Water State Revolving Fund program, 
administered by the states with EPA funding to help local governments 
meet their wastewater treatment needs, can be used in many instances for 
certain wastewater system security enhancements. While federal statutes 
governing wastewater security are limited, in December 2003, the president 
issued Homeland Security Presidential Directive 7 (HSPD-7), designating 
EPA as the lead agency to oversee the security of the water sector 
(including both drinking water and wastewater). Under the directive, EPA 
is responsible for (1) identifying, prioritizing, and coordinating 
infrastructure protection activities for the nation's drinking water and 
water treatment systems; (2) working with federal departments and 
agencies, state and local governments, and the private sector to facilitate 
vulnerability assessments; (3) encouraging the development of risk 
management strategies to protect against, and mitigate the effects of, 
potential attacks on critical resources; and (4) developing mechanisms for 
information sharing and analysis. 

Our survey of large wastewater facilities indicates that many have made 
security improvements since 9/11. While not required, most facilities 
indicated they have completed, have under way, or plan to complete some 
type of security assessment. For example, 51 percent of facilities 
responding to our survey indicated that they either completed a 
vulnerability assessment similar to that required of drinking water facilities 
under the Bioterrorism Act, or have one currently under way. In addition, 
another 23 percent of facilities reported that they have conducted, had 
under way, or planned to conduct, some type of security assessment. 
Survey responses show that security measures undertaken by large 
wastewater facilities after 9/11 have generally focused on controlling 



2 Pub. L. No. 107-188 (2002). 
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access to the treatment plant through improvements in visual surveillance, 
security lighting, and employee and visitor identification. Survey results 
also show that facilities are continuing to move away from the use of 
gaseous chlorine as a wastewater disinfectant. Fifty-six percent of facilities 
indicated they do not use chlorine gas as a wastewater disinfectant, while 
another ten percent indicated they plan to stop using the gas. Importantly, 
survey results show that facilities have taken little action to address 
collection system vulnerabilities. Many facilities cited a shortage of the 
considerable funds required to secure a collection system that covers a 
large area and has many, often remote, access points. Consequently, few 
have installed, or plan to install, manhole intrusion sensors, manhole locks, 
or sensors to detect toxics or other biochemical threats to their collection 
system. Others reported that taking other measures, such as converting 
from gaseous chlorine to a safer disinfection process, took priority over 
protecting infrastructure in their collection systems. Survey results show 
that a lack of funding and federal security guidelines remain a concern for 
many wastewater facility managers. For its part, EPA is funding efforts to 
develop security guidance related to wastewater collection systems that 
should help inform wastewater facility managers of security options in this 
area. 

While EPA and DHS have several initiatives under way to address the 
security concerns of wastewater facility managers, efforts to provide 
critical and threat-related information would benefit from additional 
coordination. EPA and DHS fund multiple information services designed to 
communicate information to the water sector. Specifically, EPA funds the 
Water Information Sharing and Analysis Center (WaterlSAC) and its Water 
Security Channel, while DHS funds the Homeland Security Information 
Network (HSIN). EPA, DHS, and other industry experts have expressed 
concern that these multiple information services may overlap and produce 
inefficiencies. A Water Sector Coordinating Council was created with 
representative members of the water community to, among other things, 
identify the appropriate use of and the relationship among the WaterlSAC, 
the Water Security Channel, and HSIN. We believe that steps could be taken 
that would improve the efficiency with which limited available funds are 
being spent to communicate information to the water sector. For example, 
a substantial part of the $2 million annual grant EPA uses to fund the 
WaterlSAC is dedicated to purchasing computer services likely available 
through DHS and HSIN at no cost. According to EPA, a preliminary review 
is under way by the Water Sector Coordinating Council that examines 
options for improving coordination between the WaterlSAC, the Water 
Security Channel, and HSIN. However, the scope of the preliminary review 
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is not clear, nor is a time frame set to complete the review. Consequently, 
we are recommending that the Administrator of EPA work with DHS and 
the Water Sector Coordinating Council to identify areas where the 
WaterlSAC and HSIN networks could be better coordinated, focusing in 
particular on (1) how operational duplications and overlap could be 
addressed, and (2) how water systems' access to timely security threat 
information could be improved. We are also recommending that EPA work 
with DHS and the Water Sector Coordinating Council to identify realistic 
time frames for the completion of these tasks. 



BcLCkgrOlind Nationwide, more than 16,000 POTWs serve more than 200 million people, 

J or about 70 percent of the nation's total population. The remaining 

population is served by privately-owned utilities or by on-site systems, such 
as septic tanks. A relative handful of large wastewater systems serve the 
great majority of people, as about 500 large public wastewater systems 
provide service to 62 percent of the population connected to a sewer 
system. In addition to serving residential populations, approximately 
27,000 commercial and industrial facilities rely on wastewater treatment 
facilities to treat their wastewater. POTWs discharge treated effluent into 
receiving waters and are regulated under the Clean Water Act. 

Wastewater systems vary by size and other factors, but all include a 
collection system and a treatment facility. 

• The collection system is the underground network of sewers including 
both sanitary and storm water collection lines. Collection systems tend 
to be dispersed geographically and have multiple access points, 
including drains, catch basins, and manholes. Lines may range from 4 
inches to greater than 20 feet in diameter, and access is usually 
conducted through manholes that are typically 300 feet apart. Many 
collection systems rely on gravity to maintain the flow of sewage 
through the pipes toward the treatment plant. However, collection 
systems may also depend on pumping stations to propel the flow when 
gravity alone is insufficient. Nationwide, there are approximately 
800,000 miles of sewer lines and 100,000 major pumping stations. 

• The wastewater treatment facility receives wastewater from the 
collection system and begins the treatment process which typically 
involves several stages before treated effluent is released into receiving 
waters. Primary treatment includes removal of larger objects through a 
screening device or a grit removal system, and the removal of solids 
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through sedimentation. Secondary stage treatment includes a biological 
process that consumes pollutants, as well as final sedimentation. Some 
facilities also use tertiary treatment to remove nutrients and other 
matter even further. Following these treatments, the wastewater is 
disinfected to destroy harmful bacteria and viruses. Disinfection is often 
accomplished with chlorine, which is stored in gaseous or liquid form 
on-site at the wastewater treatment plant. The collection system and 
treatment process is typically monitored and controlled by a 
Supervisory Control and Data Acquisition (SCAD A) system, which 
allows utilities to control such things as the amount of chlorine needed 
for disinfection. 

Wastewater treatment facilities may possess certain characteristics that 
terrorists could exploit either to impair the wastewater treatment process 
or to damage surrounding communities and infrastructure. For example, 
the numerous storm drains, manholes, and sewers that make up a 
community's wastewater collection system's network of sewers could be 
used to covertly place explosives beneath a major population center or to 
introduce substances that may damage a wastewater treatment plant's 
process. Damage to (or destruction of) tanks that hold large amounts of 
gaseous chlorine used to disinfect wastewater could release the potentially 
lethal gas into the atmosphere. Such events could result in loss of life, 
destruction of property, and harm to the environment. 

Documented accidents and intentional acts highlight the destruction that 
could arise from an attack on a wastewater system. 

• In June 1977 in Akron, Ohio, an intentional release of naptha, a cleaning 
solvent, and alcohol into a sewer by vandals at a rubber manufacturing 
plant caused explosions 3.5 miles away from the plant, damaging about 
5,400 feet of sewer line and resulting in more than $10 million in 
damage. 

• In 1981 in Louisville, Kentucky, thousands of gallons of a highly 
flammable solvent, hexane, spilled into the sewer lines from a local 
processing plant. Fumes from the solvent ignited, and the resulting 
explosions collapsed a 12-foot diameter pipe and damaged more than 2 
miles of streets. No one was seriously injured, but sewer line repairs 
took 20 months, followed by several more months to repair the streets. 
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• In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused 
explosions that killed 215 people, injured 1,500 others, damaged 1,600 
buildings, and destroyed 1.25 miles of sewer. 

• In 2002 in Hagerstown, Maryland, chemicals from an unknown source 
entered the wastewater treatment plant and destroyed the facility's 
biological treatment process. The event resulted in the discharge of 
millions of gallons of partially treated sewage into a major tributary of 
the Potomac River, less than 100 miles from a water supply intake for 
the Washington, D.C., metropolitan area. 

In January 2005, we reported the views of 50 nationally recognized experts 
on key issues concerning wastewater security. Our panel of experts 
identified five key wastewater assets as most vulnerable to terrorist 
attacks: the collection systems' network of sewers (42 of 50 experts), 
treatment chemicals (32 of 50 experts), key components of the treatment 
plant (29 of 50 experts), control systems (18 of 50 experts), and pumping 
stations (16 of 50 experts). When asked to identify and set priorities for the 
security-enhancing activities most deserving of federal support, the expert 
panel identified 11 key actions, but ranked three as deserving highest 
priority — replacing gaseous chemicals used in the wastewater treatment 
process; improving local, state, and regional efforts to coordinate 
responses in advance of a potential terrorist threat; and completing 
vulnerability assessments for individual wastewater systems. 



Federal law does not address wastewater security as comprehensively as it 
does drinking water security. In particular, wastewater facilities are not 
required by law to complete vulnerability assessments. The Clean Air Act 
does require wastewater facilities using certain amounts of hazardous 
substances, such as chlorine gas, to submit to EPA a risk management plan 
that lays out accident prevention and emergency response activities. Also, 
under EPA guidance, the Clean Water State Revolving Fund can be used in 
many instances for certain wastewater system security enhancements. 
While federal law governing wastewater security is limited, in December 
2003, the president issued HSPD-7. The directive designated EPA as the 
lead agency to oversee the security of the water sector, including both 
drinking water and wastewater critical infrastructures. 



Federal Laws and 
Directives Related to 
Wastewater Security 
Are Limited 
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Federal Law Does Not 
Address Wastewater 
Security As It Does Drinking 
Water 



In 2002, Congress passed the Bioterrorism Act, which amended various 
laws, including the Safe Drinking Water Act. 3 The Bioterrorism Act required 
drinking water systems serving more than 3,300 people to complete 
vulnerability assessments of their facilities by June 2004 and to prepare or 
update an existing emergency response plan. The Bioterrorism Act 
required the assessments to include, but not be limited to, a review of six 
components: (1) pipes and constructed conveyances; (2) physical barriers; 
(3) water collection, pretreatment, treatment, storage, and distribution 
facilities; (4) electronic, computer, or other automated systems which are 
utilized by the public water system; (5) the use, storage, or handling of 
various chemicals; and (6) the operation and maintenance of such 
systems. 4 Under the act, the emergency response plans were to include 
plans, procedures, and identification of equipment to lessen the impact on 
public health and the drinking water supply of terrorist attacks or other 
intentional acts against drinking water systems. The act authorized $210 
million for fiscal year 2002, mostly to assist drinking water systems in 
completing vulnerability assessments, preparing or updating response 
plans, and making needed security improvements. Drinking water systems 
are not required to implement any risk-reduction actions based on their 
vulnerability assessments or report to EPA on measures that have been 
implemented. 



In 2003, the Congress considered alternative bills that would have 
encouraged or required wastewater treatment plants to assess the 
vulnerability of wastewater facilities, make physical security 
improvements, and conduct research. However, the legislation did not 
become law and, consequently, no such requirement or specific funding 
exists for wastewater facilities. 



3 42 U.S.C. §§ 300f-300j. 

4 When we discuss vulnerability assessments in this report, we are referring to assessments 
that include the review criteria identified in the Bioterrorism Act and in EPA guidance. EPA 
issued guidance on vulnerability assessments for drinking water systems regulated under 
the Bioterrorism Act that stated the assessments should address six key elements: (1) 
characterization of the system, including its mission and objectives; (2) identification and 
prioritization of adverse consequences to avoid; (3) determination of critical assets that 
might be subject to malevolent acts that could result in undesired consequences; (4) 
assessment of the likelihood of such malevolent acts; (5) evaluation of existing 
countermeasures; and (6) analysis of current risk, and development of a prioritized plan for 
risk reduction. 
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Other Federal 
Environmental Laws 
Address Some Areas of 
Security at Wastewater 
Facilities 



While federal law does not require wastewater systems to take security 
measures to protect specifically against a terrorist attack, it does require 
certain wastewater facilities to take security precautions that could 
mitigate the consequences of such an attack. For example, the 1990 Clean 
Air Act amendments 5 mandated EPA oversight of risk management 
planning at facilities that handle more than specified-threshold quantities 
of hazardous substances, including the gaseous chlorine often used as a 
disinfectant at wastewater facilities. 6 Specifically, EPA regulations 
implementing the Clean Air Act require these facilities to prepare Risk 
Management Plans (RMPs) that summarize the potential threat of sudden, 
accidental, large releases of certain chemicals; including the results 
occurring off-site in a worst-case chemical accident, and the facility's plan 
to prevent releases and mitigate any damage. RMPs are to be revised and 
resubmitted to EPA at least every 5 years, and EPA is required to review 
them and require revisions, if necessary. 

For a March 2003 report, 7 EPA told us it believed the Clean Air Act could be 
interpreted to provide authority to address site security from terrorist 
attacks at RMP facilities, because the act imposes certain requirements on 
these facilities regarding "accidental releases." The act defines an 
accidental release as an unanticipated emission of a regulated substance or 
other extremely hazardous substance into the air, so any chemical release 
caused by a terrorist attack could be considered "unanticipated" and 
covered under the Clean Air Act. Such an interpretation would provide EPA 
with authority under the act's RMP provisions and general duty clause 8 to 
require security measures or vulnerability assessments with regard to 
terrorism. However, EPA has not attempted to use these Clean Air Act 
provisions because it is concerned that such an interpretation would pose 
significant litigation risk and has concluded that chemical facility security 
would be more effectively addressed by passage of specific legislation. 



5 Pub. L. No. 101-549 (1990). 

6 EPA requires that any facility storing at least 2,500 pounds of chlorine gas submit a RMP. 

'GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, 
but the Extent of Security Preparedness Is Unknown, GAO-03-439 (Washington, D.C.: 
March 14, 2003). 

Specifically, section 112(r)(l) of the Clean Air Act includes a general duty clause directing 
owners and operators of facilities that produce, process, handle, or store listed or other 
extremely hazardous substances to identify hazards, design and maintain a safe facility to 
prevent releases, and minimize the consequences of any accidental releases that occur. 
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Wastewater facilities that store certain amounts of hazardous chemicals 
may also be subject to the Resource Conservation and Recovery Act. 9 
Under regulations implementing the act, facilities that house hazardous 
waste generally must take certain security actions, such as posting warning 
signs and using a 24-hour surveillance system, or surrounding the active 
portion of the facility with a barrier and controlled entry gates. 10 However, 
according to EPA, these security measures are aimed at keeping out 
trespassers or wanderers, not intentional intruders. 

Other federal statutes impose safety requirements on certain wastewater 
facilities that may incidentally reduce the likelihood and mitigate the 
consequences of terrorist attacks. For example, the Occupational Safety 
and Health Act 11 imposes a number of safety requirements, including a 
general duty to furnish a workplace free from recognized hazards that may 
cause death or serious physical harm to employees. The Emergency 
Planning and Community Right-to-Know Act 12 requires owners of facilities 
that maintain specified quantities of certain extremely hazardous 
chemicals to submit information annually on their chemical inventory to 
state and local emergency response officials. The act also requires that 
each state establish a State Emergency Response Commission to oversee 
local emergency planning and create local emergency planning 
committees. These committees must develop and periodically review their 
communities' emergency response plans, including the identification of 
chemical facilities, and outline procedures for response personnel to 
follow in the event of a chemical incident. 

Aside from statutes that address some areas of wastewater security, EPA 
has asserted that federal funding is available for wastewater security- 
related measures through the Clean Water State Revolving Fund (CWSRF) 
program. 13 The CWSRF is an EPA-administered program that provides 
grants to the states to fund a variety of water-quality projects, including 
those at municipal wastewater treatment facilities. States may use the 
funds to provide loans to local governments to assist wastewater utilities in 

9 Pub. L. No. 94-580 (1976), 42 U.S.C. §§ 6901-6992k. 
10 40 C.F.R. §264.14. 

"Pub. L. No. 91-596 (1970), 29 U.S.C. §§ 651-678. 
12 Pub. L. No. 99-499 (1986), 42 U.S.C. §§ 11001-11050. 
13 Pub. L. No. 100-7 (1987). 
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making infrastructure improvements needed to protect public health and 
ensure compliance with the Clean Water Act. According to EPA, states may 
use the CWSRF to assist utilities in completing a variety of security-related 
actions, such as vulnerability assessments, contingency plans, and 
emergency response plans. In addition, EPA has identified other 
infrastructure improvements that may be eligible for funding, such as the 
conversion from gaseous chemicals to alternative treatment processes, 
installation of fencing or security cameras, securing large sanitary sewers, 
and installing tamper-proof manholes. 14 In our January 2005 report 
summarizing experts' views on wastewater security, a number of experts 
expressed caution about relying heavily on the CWSRF program to support 
security enhancements, largely because of the time-lag in obtaining funds 
for security-related measures, and because such demands on the CWSRF 
would divert needed funding away from the kind of critical infrastructure 
investments that are the CWSRF program's primary purpose. 

Another source of federal funding potentially available for wastewater 
security-related measures is the State Homeland Security Grant Program 
administered by DHS. This program's primary objectives are to enhance the 
capacity of state and local emergency responders to prevent, protect 
against, respond to, and recover from terrorist incidents involving 
chemical, biological, radiological, nuclear, and explosive devices; 
agriculture; and cyber attacks. Under the program, grants are provided to 
states for a variety of purposes, including homeland security-related 
training and protection of critical infrastructure, although authority to 
make physical security improvements is limited. States are required to 
allocate at least 80 percent of these grant funds to "local units of 
governments," which, as defined in the conference report accompanying 
the Department of Homeland Security Appropriations Act for fiscal year 
2006, include water districts, special districts, and other political 
subdivisions of a state. 



14 EPA fact sheet, "Use of the Clean Water State Revolving Fund to Implement Security 
Measures at Publicly-owned Wastewater Treatment Works" (Washington, D.C., 2003). 
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In December 2003, the president issued HSPD-7, which established a 
national policy for federal departments and agencies to identify and set 
priorities for the nation's critical infrastructures and to protect them from 
terrorist attacks. HSPD-7 established EPA as the lead federal agency to 
oversee the security of the water sector, both drinking water and 
wastewater. Presidential Decision Directive 63 had done so earlier in May 
1998, with a focus primarily on water supply. 

Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and 
coordinating infrastructure protection activities for the nation's drinking 
water and water treatment systems; (2) working with federal departments 
and agencies, state and local governments, and the private sector to 
facilitate vulnerability assessments; (3) encouraging the development of 
risk management strategies to protect against and mitigate the effects of 
potential attacks on critical resources; and (4) developing mechanisms for 
information sharing and analysis. 

HSPD-7 also called for DHS to integrate all critical infrastructure security 
efforts among federal agencies and to complete a comprehensive national 
plan for critical infrastructure and key resource protection — now called the 
National Infrastructure Protection Plan. Under HSPD-7, seven federal 
agencies, including EPA, were designated sector-specific agencies. DHS 
issued guidance tasking each sector-specific agency with developing 
sector-specific plans for input into the comprehensive plan. Each sector- 
specific plan is supposed to outline strategies for (1) collaborating with all 
relevant federal departments and agencies, state and local governments, 
and the private sector; (2) identifying assets; (3) conducting or facilitating 
vulnerability assessments; and (4) encouraging risk management strategies 
to protect against and mitigate the effects of an attack. The water sector- 
specific plan will be an appendix to the National Infrastructure Protection 
Plan. On January 20, 2006, DHS issued its revised National Infrastructure 
Protection Plan based on comments it received on an earlier version of the 
plan. DHS accepted additional comments on the revised version until 
February 6, 2006, and expects to issue a final version of the plan later in 
2006. Sector-specific agencies are required to submit their sector-specific 
plans to DHS within 6 months after the National Infrastructure Protection 
Plan is made final. 



EPA Was Assigned Lead 
Federal Responsibility for 
Water-Sector Security 
Including Wastewater 
Facilities 
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Many Large 
Wastewater Facilities 
Have Made Security 
Improvements but 
Efforts to Protect 
Collection Systems 
Have Been Limited 



Our survey of large wastewater facilities indicates that many have taken 
steps to improve security Most facilities that responded to our survey have 
completed, have under way, or plan to complete some type of security 
assessment. Roughly two-thirds of facilities also reported they used a 
disinfectant other than gaseous chlorine or plan to switch from the gas. Of 
those facilities that continue to use gaseous chlorine, many have taken 
steps to increase security by limiting and monitoring access to gaseous 
chlorine storage areas or through other actions. Survey responses show 
that since 9/11, wastewater treatment facilities have also focused security 
efforts on controlling and limiting access to their treatment plants. 
Importantly, facilities have taken fewer security actions intended to protect 
treatment collection systems. Many facilities reported that taking other 
measures to protect their treatment plants, including converting from 
gaseous chlorine to a safer disinfection process, took priority over 
protecting infrastructure in their collection systems. Survey results show a 
lack of funding and federal security guidelines remain a concern for many 
wastewater facility managers. 



Most Facilities Have 
Conducted or Plan to 
Conduct Some Type of 
Security Assessment 



Seventy-four percent of facilities that responded to our survey reported 
they completed, were in the process of completing, or planned to complete 
some type of security assessment — either a vulnerability assessment, 
similar to that which was required of drinking water facilities under the 
Bioterrorism Act, or another type of security assessment. As shown in 
figure 1, 106 facilities — or 51 percent of those responding to our survey — 
indicated that they had completed a vulnerability assessment or were 
currently conducting a vulnerability assessment. 
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Figure 1 : 




Security assessment 
completed or underway (22) 



No plans to do either a vulnerability 
or security assessment (23) 

Plan to conduct either a vulnerability 
or security assessment (24) 



Don't know/no response (31) 

Vulnerability assessment 
complete or underway (106) 



Source: GAO survey of wastewater facilities. 



Of the 106 facilities that indicated they had either completed a vulnerability 
assessment or had one under way, 80 indicated their vulnerability 
assessments were complete, while 26 indicated the assessment was still in 
process. As shown in the figure, 22 facilities — or 11 percent of all 
responses — indicated they had conducted another type of security 
assessment or were in the process of conducting another type of security 
assessment, while 24 facilities — or 12 percent of all responses — indicated 
they plan to conduct either a vulnerability or another type of security 
assessment. 



Twenty-three facilities — or 11 percent of total responses — indicated they 
had no plans to conduct any type of security assessment. When asked to 
identify reasons for not conducting a vulnerability or security assessment, 
17 of these 23 facilities cited a lack of requirement to do so, while 15 noted 
that they considered security actions taken at their facilities adequate for 
their security needs. Thirteen of these facilities indicated that their 
emergency response plan was updated and this seemed sufficient to 
address potential vulnerabilities. 
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Facilities cited several reasons for completing a vulnerability or some other 
type of security assessment, but most — roughly 77 percent — reported 
doing so on their own initiative. Thirty-seven percent of facilities reported 
that they did so in conjunction with the required assessment for their 
drinking water facility. 15 To a lesser extent, facilities cited state, local, and 
utility governing-body requirements as reasons they conducted 
assessments. See appendix II for survey results related to vulnerability and 
security assessments at large wastewater facilities. 



Most Large Facilities Have 
Discontinued or Plan to 
Discontinue Use of Gaseous 
Chlorine, and Chlorine 
Users Have Pursued Other 
Security Enhancements 



As shown in figure 2, over half of large wastewater facilities in our survey 
reported they use an alternative to gaseous chlorine in their disinfection 
process. These results are consistent with studies which conclude that over 
the past decade, wastewater treatment facilities have moved away from 
gaseous chlorine as a disinfectant. 



Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities 

2% 

Does not know/no response (5) 




Currently uses gaseous chlorine (85) 



Does not use gaseous chlorine (116) 



Source: GAO survey of wastewater facilities. 

Note: Totals do not add to 100 percent due to rounding. 



15 Forty-eight percent of facilities responding to our survey indicated they were combined 
systems, in that they managed both drinking water and wastewater treatment. 
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Of the facilities not using gaseous chlorine, 89 reported using sodium 
hypochlorite as their primary disinfectant. Sodium hypochlorite is 
essentially a strong version of household bleach and is considered safer 
than gaseous chlorine. Seventeen facilities report they are using ultraviolet 
light as their primary disinfectant. The remaining facilities did not identify 
the type of disinfectant method used at their facility. 

In our January 2005 report, we noted that the change, for an individual 
plant, to sodium hypochlorite may require approximately $12.5 million for 
new equipment and increase annual chemical costs from $600,000 for 
gaseous chlorine to over $2 million for sodium hypochlorite. However, one 
expert noted some costs may be offset through savings in regulatory 
paperwork and certain emergency planning efforts. In our survey, we asked 
facilities that switched from gaseous chlorine if their annual costs 
increased, stayed the same, or decreased after switching to an alternate 
disinfection method. Fifty-eight facilities reported that costs increased, 11 
noted that costs have stayed about the same, and one facility reported that 
costs decreased. 

Of the 85 facilities that reported use of gaseous chlorine, 20 — or roughly 10 
percent of all 206 reporting facilities — indicated that they have plans to 
switch from gaseous chlorine to another disinfectant. In addition, as shown 
in figure 3, many reported taking additional steps after 9/11 to mitigate the 
potential risks associated with continued reliance on chlorine. 
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Figure 3: Security Measures at Large Wastewater Facilities That Still Use Gaseous 
Chlorine 



Security measure 
Restricted access to 

chlorine storage area 1 

Installed electronic surveillance 

of chlorine storage area 

Other physical improvements 
to chlorine storage area 3 

Converted from large to smaller 
chlorine storage containers 

10 20 30 40 50 60 

Number of facilities 

Before 9/11 
After 9/11 

Source: GAO survey of wastewater facilities. 

"Other physical improvements include, among others, improvements to gates and fencing; physical 
barriers, security guards, intrusion alarms and motion detectors; and enclosure of the chlorine storage 
area. Results are based on 85 facilities that reported using gaseous chlorine as a primary disinfectant. 

Forty-one facilities using gaseous chlorine reported that they instituted 
controls for selective access to chlorine storage areas after 9/11, while 30 
facilities reported making other security improvements to the storage area, 
such as installing electronic surveillance of the chlorine storage area or 
improving gates and fencing. Fewer facilities reported that they decided to 
store gaseous chlorine in smaller-quantity containers, likely because most 
reported they already stored the gas in one-ton containers, which are 
among the smallest containers used at large wastewater facilities for the 
gas. 16 See appendix II for survey results on gaseous chlorine use at large 
wastewater facilities. 



16 Specifically, of the 85 facilities reporting current use of gaseous chlorine, 59 store gaseous 
chlorine in one-ton containers. This method of storage is considered by experts to be safer 
than storing it in larger containers because ruptures or leaks would be limited to smaller 
areas. Three facilities reported storing gaseous chlorine in 150-pound cylinders. Six facilities 
reported storing gaseous chlorine in 17-ton tractor trailers, while nine reported storing the 
gas in 91-ton rail cars. Eight facilities did not report a storage method. 



Page 17 



GAO-06-390 Wastewater Facility Security 



Security Efforts Have 
Generally Focused on 
Improved Control of 
Wastewater Treatment Plant 
Access, While Efforts to 
Protect Collection Systems 
Have Been Limited 



As shown in figure 4, many facilities reported taking basic security 
measures prior to 9/11, such as installing vehicle gates and security fencing. 
Survey respondents also indicated that many information technology 
security measures, such as virus protection programs, backup power 
supplies, and firewall and intrusion detection systems, were implemented 
before 9/11. 

The figure shows that security enhancements made or planned by large 
wastewater facilities after 9/11 generally focus on controlling access to the 
treatment plant. Such security enhancements include adding visual 
surveillance monitoring, increasing security lighting, implementing 
employee and visitor identification policies, adding guard stations, and 
upgrading SCADA capability and security. 

Importantly, few facilities reported taking measures to address collection 
system vulnerabilities other than having available redundant pumping 
devices or collection bypass systems. For example, few have installed or 
plan to install manhole intrusion sensors, manhole locks, or sensors to 
detect toxics or other biochemical threats to their collection systems. This 
lack of attention to collection system vulnerabilities is important because 
42 of the 50 experts polled in our January 2005 report on wastewater 
security identified the collection systems' network of sanitary, storm, and 
combined sewers as the most vulnerable asset of a wastewater utility. 
Several noted that sewers make underground travel from a point of entry to 
a potential target almost undetectable, possibly allowing sewers to be used 
as an underground transport system for explosive or toxic agents. 

Many facilities reported that other measures to protect their treatment 
plants, including converting from gaseous chlorine to a safer disinfection 
process, took priority over protecting infrastructure in their collection 
systems. Other managers cited the difficulty and expense in securing 
collection systems that, by nature, cover a large area and have many, often 
remote, access points. One manager expressed confusion about whether to 
concentrate monitoring resources on large interceptor sewer lines to 
prevent entry or on toxic materials that could be introduced at nearly every 
access point to his system. Others noted the lack of facility control over 
collection systems. One facility manager told us his facility treats 
wastewater that is collected from 17 separate collection systems. Finally, a 
number of respondents questioned whether the technologies purportedly 
available to detect potential threats introduced to collection systems are 
sufficiently capable of achieving this objective. 
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Figure 4: Security Measures at Large Wastewater Facilities 
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Source: GAO survey of wastewater facilities. 

Note: Figure is based on results from 206 wastewater facilities. 
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Nonetheless, a few facility managers with whom we spoke told us they 
have made efforts to address collection system security, particularly in the 
protection of their pump stations. One facility manager told us his facility 
has a project under way to install security locks and card-access controls at 
all 93 of its pumping stations. According to the manager, the concentration 
of and need to protect capital equipment, and the potential impact of 
damage or destruction of that infrastructure prompted the facility to direct 
its capital improvement efforts to securing pumping stations. 

While many facilities in our survey indicated they made some security 
improvements after 9/11, facility managers cited limited resources and 
other priorities as reasons for not implementing further security measures. 
Facility managers and other industry experts with whom we spoke noted 
that security upgrades must compete with other infrastructure needs for 
available resources. For instance, many wastewater facilities' collection 
systems are outdated, and they are already facing large costs to expand and 
repair their aging systems and reduce incidences of combined sewer 
overflows. 17 Major U.S. cities, such as Washington, D.C., and Cincinnati, 
Ohio, are facing costs between $1 and $2 billion to implement necessary 
capital improvements. See appendix II for survey results on physical, 
personnel, and information technology security measures taken at large 
wastewater facilities. 



Many Facility Managers 
Reported a Need for 
Additional Funding and 
Other Assistance to Further 
Security Improvements 



In our survey, we asked wastewater facility managers what the federal 
government could do to improve security at wastewater facilities. Facility 
manager responses are categorized in table 1. 



"Combined sewer systems collect rainwater runoff, domestic sewage, and industrial 
wastewater in the same pipe. During periods of heavy rainfall or snowmelt the wastewater 
volume in a combined sewer system can exceed the capacity of the sewer system or 
treatment plant, resulting in an overflow and discharge of untreated wastewater directly to 
nearby streams, rivers, or other water bodies. EPA considers these overflows to be a major 
pollution concern for the approximately 772 cities that have combined sewer systems. 
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Table 1 : Wastewater Facility Managers' Opinions on Recommended 


Federal Role 




Number of 


Recommended federal role 


responses 


Funding 


102 


Guidelines, standards, best practices, expertise, and information 


36 


Training and education 


14 


Requirements and mandates 


14 


Providing threat or security information 


9 


Other 


18 



Source: GAO survey of wastewater facilities. 

Facility managers predominantly recommended additional funding to 
further wastewater security improvements. Many facility managers 
recommended targeting funding to specific measures, such as performing 
vulnerability assessments, purchasing specific security equipment such as 
surveillance cameras, or covering costs associated with switching from 
gaseous chlorine to a safer disinfectant. To a much lesser extent, 
wastewater facility managers commented that the federal government 
could be of greater assistance in providing security guidance, standards, 
and best practices. For example, one facility manager we interviewed 
expressed a need for federal guidance and best practices on collection 
system security. For its part, in 2002, EPA provided funding to the 
American Society of Civil Engineers (ASCE) to develop a set of security 
guidance documents that cover the design of online contaminant 
monitoring systems, and physical security enhancements of drinking water, 
wastewater, and storm water infrastructure systems. ASCE sub-contracted 
with American Water Works Association and the Water Environment 
Federation (WEF) for assistance on this project. In 2004 these documents 
were released as interim voluntary security design standards for the water 
sector and finalized standards are to be established in late 2006 or early 
2007. These security-focused documents are intended to serve as a 
foundation to help water utilities address potential vulnerabilities through 
sound design, construction, and operation and maintenance practices. 
According to a WEF representative, one set of standards is to be directed at 
physical security measures for wastewater collection systems. The security 
standards are to be published in late 2006 and are to include both 
prescriptive and performance-based criteria that focus on physical security 
upgrades that reduce risk to water, wastewater, and storm water 
infrastructure arising from malevolent events. 
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EPA and DHS Have 
Several Initiatives to 
Enhance Wastewater 
Facility Security, Yet a 
Key Effort Requires 
Additional 
Coordination 



EPA and DHS have a number of initiatives under way related to wastewater 
facility security. For example, EPA has funded programs to develop 
vulnerability assessment tools and provide training to wastewater facilities 
on the use of these tools, while DHS has conducted site assessment visits at 
wastewater facilities. While these initiatives are helping to address security 
concerns in the wastewater sector, EPA and DHS efforts could nonetheless 
be more effective with greater coordination over how best to convey 
security-related and threat information to the wastewater treatment 
community. 



EPA and DHS Have Several 
Initiatives Under Way 
Related to Wastewater 
Security 



Since 2002, EPA has provided more than $10 million to help address the 
security needs of the wastewater sector. EPA funded the development and 
dissemination of several risk assessment methodologies to assist water 
sector utilities in identifying how to better protect their critical 
infrastructures. In addition, EPA funded training for wastewater utilities on 
how to conduct risk assessments and update or complete emergency 
response plans. EPA provided funding to the Association of Metropolitan 
Sewerage Agencies 18 to develop a software tool, called the Vulnerability 
Self Assessment Tool (VSAT), for drinking water utilities. In addition, 
through an interagency agreement with EPA, the Department of Energy's 
Sandia National Laboratories provided training to selected firms in a 
vulnerability assessment methodology developed by the labs, called the 
Risk Assessment Methodology for Water Utilities (RAM-W). For 
vulnerability assessments at smaller water systems, EPA supported the 
dissemination of the Security and Emergency Management System (SEMS) 
software tool. 



Sixty-nine wastewater facilities responding to our survey indicated they 
used, were currently using, or planned to use the VSAT software to 
complete a vulnerability or security assessment; 27 facilities indicated they 
either used, were currently using, or planned to use the RAM-W assessment 
tool. Another four facilities indicated they either used, were currently 
using, or planned to use the SEMS software. 

EPA has also reorganized its own internal structure and sought input from 
experts outside of the agency to better assist the wastewater industry's 



18 Now the National Association of Clean Water Agencies (NACWA). 
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security efforts. In particular, in 2003, EPA created a Water Security 
Division to work with the states, tribes, drinking water and wastewater 
utilities, and other partners to enhance the security of water and 
wastewater utilities and the ability to respond effectively to security threats 
and breaches. In addition, in 2004, the National Drinking Water Advisory 
Council (NDWAC), 19 at EPAs request, established a Water Security Working 
Group made up of 16 members from wastewater utilities, drinking water 
utilities, and environmental and rate-setting organizations to advise on the 
development of best security practices and policies for water utilities. The 
group advises the NDWAC on ways to address several specific security 
needs of the sector. In June 2005, the working group provided NDWAC with 
a report that identified features of an active and effective security program 
and ways to measure the adoption of these practices. 

As noted, EPA provided funding to ASCE to develop a set of security 
guidance documents that cover the design of online contaminant 
monitoring systems, and physical security enhancements of drinking water, 
wastewater, and storm water infrastructure systems. This effort, called the 
Water Infrastructure Security Enhancement project, is to address physical 
infrastructure security needs in the water sector by issuing guidance 
documents, training materials, and voluntary standards relating to water 
infrastructure security. The project group is currently developing physical 
security standards that focus on physical security upgrades to reduce risk 
to water, wastewater, and storm water arising from malevolent acts. 

For its part, DHS has two broad initiatives that have facilitated efforts to 
improve wastewater security. First, the Buffer Zone Protection program is 
a DHS grant program designed to reduce specific vulnerabilities at a critical 
infrastructure or key resource site by assisting local law enforcement to 
develop a plan for preventative and protective measures that make it more 
difficult for terrorists to plan or launch attacks from the immediate vicinity 
of the site. They also identify equipment that could be purchased to 
mitigate the vulnerabilities. Upon plan approval, DHS grants funds for 
procuring materials and equipment necessary for implementation of the 
site's buffer zone protection plan. According to DHS, as of October 31, 
2005, security at 14 wastewater facilities has been reviewed under the 
Buffer Zone Protection program. 



19 NDWAC is a federal advisory committee that supports EPA in performing its duties and 
responsibilities related to the national drinking water program. The council was created on 
December 16, 1974, through a provision in the Safe Drinking Water Act. 
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Under its second broad initiative, the Site Assistance Visits program, DHS 
visits critical infrastructure sites nationwide to address key areas of 
concern at facilities requiring security enhancements. DHS subject matter 
experts in the areas of physical security measures, system 
interdependencies, and terrorist attack prevention conduct these visits — 
generally lasting 1 to 3 days — in which, among other things, the 
vulnerabilities of the site or facility are identified and mitigation options are 
discussed. According to DHS, as of October 31, 2005, a total of 350 site 
assessment visits have been conducted. Of this total, seven were conducted 
with wastewater facilities. 

In addition to these programs, DHS funded a NAC WA project to develop a 
decision tree and report template to help water systems assess and 
examine chlorine gas alternatives for water and wastewater disinfection. 
The decision tree guides water systems in evaluating the potential costs 
and benefits of conversion and determining whether an alternative 
disinfection method will still enable them to meet their permit 
requirements. The report template is to ensure that the results of the 
decision tree analysis are reported in a consistent format, improving a 
water system's ability to pursue and secure any available state or federal 
funding for conversion. According to a NAC WA representative, they are in 
the process of finishing the design of the decision tool and, once the final 
product is reviewed and approved by DHS, printing of the CD tool will 
begin. NAC WA expects to make the tool available to water and wastewater 
utilities free of charge no later than the end of March 2006. 

While EPA and DHS have these wastewater security-related initiatives 
under way, the Congress has expressed concerns that EPAs homeland 
security responsibilities are not well articulated in relation to DHS' 
responsibilities. In the conference report for the fiscal year 2005 
Consolidated Appropriations Act, conferees directed EPA to enter into a 
memorandum of understanding (MOU) with DHS that defines the 
relationship and responsibilities of the two entities regarding homeland 
security and protection. EPA did not enter into the MOU, but instead, on 
November 1, 2005, issued a report to the Congress entitled "Homeland 
Security Roles and Responsibilities and Interactions Between EPA and the 
Department of Homeland Security." The report identified the homeland 
security-specific authorities, core mission authorities, presidential 
directives, and existing MOUs EPA uses to implement its homeland 
security roles and responsibilities. In the report, EPA stated that it believes 
its homeland security roles and responsibilities are sufficiently delineated 
not only through statutes, presidential directives, and existing MOUs, but 
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also through planning documents and deliverables associated with a wide 
variety of collaborative homeland security-related projects that EPA and 
DHS are carrying out. 



In December 2002, the Association of Metropolitan Water Agencies 
(AM WA) received a grant from EPA to establish a communication system 
to share security information with water sector utilities, known as the 
Water Information Sharing and Analysis Center (WaterlSAC). 20 The 
WaterlSAC is one of thirteen critical infrastructure and key resource sector- 
specific information sharing and analysis centers. The WaterlSAC was 
designed to meet the information sharing needs of both water and 
wastewater utilities by providing real-time alerts of possible terrorist 
activity, allowing for the secure reporting of incidents and the sharing of 
information among users, and allowing access to a library of security- 
related information and contaminant databases. Beginning in fiscal year 
2003, EPA has annually provided AMWA with a $2 million grant to support 
the WaterlSAC. This grant is augmented by subscription fees paid by 
drinking water and wastewater systems. 21 In November 2004, the 
WaterlSAC launched a free security advisory system known as the Water 
Security Channel that distributes federal advisories on security threats via 
e-mail to the water sector. The Water Security Channel also includes a 
searchable archive of federal alerts, advisories, and bulletins. However, it 
does not provide access to the same level of service as the subscription- 
based WaterlSAC. WaterlSAC subscribers receive additional services, 
including a secure communication system, access to vulnerability 
assessment tools and resources, access to an online library related to water 
security issues, and access to databases about chemical, biological, and 
radiological agents. 



20 Information Sharing and Analysis Centers (ISACs) are confidential venues for sharing 
security vulnerabilities and solutions within an industry. Presidential Decision Directive 63 
and Executive Order 13231 designated the water sector (and other industry sectors) as 
critical to the nation's well-being and called for the establishment of ISACs to promote the 
flow of security information. Additionally, HSPD-7 encouraged creation of private-sector 
information sharing and analysis mechanisms, such as the Water ISAC, to protect drinking 
water and wastewater infrastructure from attack. 

21 Water and wastewater systems with a service population over 100,000 pay an annual fee of 
$1,000, systems between 50,000 and 100,000 pay $500, and systems serving less than 50,000 
pay $200 annually. The annual fee pays for one user per system. Additional users are 
allowed, with limits, for additional fees. 



Multiple Efforts to Provide 
Critical and Threat-Related 
Information to the Water 
Sector Need Additional 
Coordination 
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DHS has also sought to enhance communication between critical 
infrastructure sectors and the government. Under the Homeland Security 
Act of 2002, DHS is responsible for reducing the vulnerability of the 
national infrastructure and for coordinating and communicating with all 
key stakeholders on homeland security-related matters. According to DHS, 
to fulfill this mandate, it requires a communication system that provides 
equal and appropriate access to security information to all owners and 
operators of critical infrastructure and key resources. In 2004, it piloted a 
new secure network, the Homeland Security Information Network (HSIN), 
to help achieve this mandate. 

HSIN is DHS' primary conduit through which it shares information on 
domestic terrorist threats, suspicious activity reports, and incident 
management. It is composed of multiple communities of interest, including 
the HSIN Critical Sector (HSIN-CS) program, which is intended to enhance 
the protection, preparedness, and crisis communication and coordination 
capabilities of the nation's 17 critical infrastructure and key resource 
sectors identified in HSPD-7. The HSIN platform for critical sectors is being 
developed and offered to each sector to provide a suite of information and 
communication tools to share critical information both within the sector, 
with DHS, and eventually across sectors. Because the water sector is one of 
the nation's 17 critical infrastructure and key resources, a HSIN-CS portal 
for the sector, called HSIN Water Sector (HSIN-WS), is currently being 
developed by DHS. A Water Sector Coordinating Council was also 
established by the water sector with representative members of the water 
sector community and charged with identifying information and other 
needs of the sector, including the appropriate use of and the relationship 
among Water ISAC, the Water Security Channel, and HSIN. 22 

While these efforts are helping to improve communication, staff at EPA and 
DHS, as well as other industry experts with whom we spoke, have 
expressed concern that the evolution of the information sharing and 
dissemination function for the water sector has resulted in several 
inefficiencies. 



22 According to DHS, sector coordinating councils are to be developed for each critical 
infrastructure and key resource area and will be responsible to determine and support the 
most effective method of information sharing and communication for the sector, whether by 
using the current ISAC or building new mechanisms. 
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• WaterlSAC access is limited to drinking water and wastewater 
subscribers, plus a restricted number of subscribers from EPA and the 
state drinking water programs. For example, the agreement limits 
designated users to five individuals at EPA headquarters and one person 
in each EPA region, for a total of fifteen EPA users. States are limited to 
only two users. EPA staff note that access for others in the sector, such 
as the technical service community, universities, training centers and 
laboratories, would benefit the overall protection of drinking water and 
wastewater critical infrastructures. EPA and DHS staff told us that, 
depending upon the user policy established by the sector, the HSIN 
network could allow for broader sharing of access than currently 
available under the WaterlSAC. 

• Only a small portion of the water sector is reached by the WaterlSAC. 
According to EPA staff, just over 530 utilities are reached by the 
WaterlSAC, while over 8,000 utilities receive information through the 
Water Security Channel. However, the Water Security Channel does not 
provide the same level of notification and information sharing provided 
by the WaterlSAC. The Water Security Channel is essentially a "push e- 
mail system" that sends out general security bulletins to water utilities 
and other users, and allows for searches of previous bulletins. This 
service is much more limited than that provided to WaterlSAC 
subscribers, which provides a secure communication system for users 
to share information, access to vulnerability assessment tools and 
resources, access to an online library related to water security issues, 
and access to databases about chemical, biological, and radiological 
agents. One water industry representative told us that the WaterlSAC 
recently lowered its subscription fees due to industry concerns that the 
fees were limiting WaterlSAC subscriptions. EPA staff told us that the 
water sector generally has less funding available to support ISAC 
services than other sectors such as electric, financial, and 
transportation. 

• WaterlSAC duplicates some operational functions likely available 
through HSIN. EPA estimates that roughly $600,000 to $700,000 of the 
annual $2 million WaterlSAC grant is used to support computer 
hardware and software for the secure web portal. Meanwhile, to support 
HSIN, DHS funds similar computer software and hardware and its 
related technical support. EPA staff noted that WaterlSAC could make 
use of the software and hardware platform available through HSIN. EPA 
staff believed that WaterlSAC could then better focus its resources on 
managing its user list, managing information content on the secure web 
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site, and analyzing and distributing threat information, while leaving 
DHS to manage and run the hardware and software. 

The current reach and levels of service offered by the WateriSAC and the 
Water Security Channel do not meet DHS' objective to establish a 
communication system that provides equal and appropriate access to 
security information to all owners and operators in this critical 
infrastructure area. According to EPA and DHS staff, the Water Sector 
Coordinating Council will consider options to improve coordination 
between the WateriSAC, the Water Security Channel, and HSIN. Using 
funding from the supporting grant from EPA, the WateriSAC is currently 
examining options for coordination between the WateriSAC, the Water 
Security Channel, and HSIN. EPA noted that this review is ongoing and will 
likely be presented in preliminary form to the Water Sector Coordinating 
Council in a mid-March 2006 meeting. However, the scope of the 
preliminary review is not clear, nor is a time frame set to complete the 
review. According to DHS, the creation of the DHS Homeland 
Infrastructure Threat and Risk Analysis Center will assist in information 
sharing of intelligence threat information between DHS and federal, state, 
and private sector partners. 



Conclusions Many of the nation's large wastewater facilities have made security 

improvements since the terrorist attacks of September 11, 2001. Of 
particular note, many have completed some type of security assessment, 
and additional facilities have such assessments under way. Our survey also 
found that wastewater facilities are continuing to move away from the use 
of potentially dangerous gaseous chlorine as a wastewater disinfectant. 
One area of continuing concern is the difficulty these facilities are having in 
addressing vulnerabilities associated with their collection systems. Facility 
managers explained that with limited funding available, other important 
measures considered to be more feasible and affordable were assigned 
greater priority. EPA is attempting to help address this difficult issue 
through funding the American Society of Civil Engineers project to develop 
voluntary physical security standards for the water sector. 

Despite limited federal authority over security at the nation's wastewater 
facilities, EPA, as the lead agency for water sector security, has worked 
with DHS and industry groups to advance wastewater security by providing 
vulnerability assessment tools, training, guidance, and burgeoning 
information sharing networks. These efforts, combined with the individual 
initiatives of many wastewater facilities, have resulted in measurable 



Page 28 



GAO-06-390 Wastewater Facility Security 



security improvements. However, these efforts could benefit from 
additional coordination, and we acknowledge and support EPA's and DHS' 
commitment to do so. As these agencies move forward, we believe they 
should act upon the opportunities we have identified that could improve 
both the efficiency with which limited dollars are being spent, as well as 
the delivery of vital information services to the wastewater community. 
Specifically, a substantial part of the $2 million annual EPA grant that funds 
WaterlSAC goes to support a computer platform that may be available at no 
cost through HSIN. 



We recommend that the Administrator of EPA work with DHS and the 
Water Sector Coordinating Council to identify areas where the WaterlSAC 
and HSIN networks could be better coordinated, focusing in particular on 
(1) how operational duplications and overlap could be addressed, and (2) 
how water systems' access to timely security threat information could be 
improved. We also recommend that EPA work with DHS and the Water 
Sector Coordinating Council to identify realistic time frames for the 
completion of these tasks. 



We provided a draft of this report to DHS and EPA for review and 
comment. DHS agreed with the factual content of the report, and its Office 
of Infrastructure Protection provided written technical comments and 
clarifications that have been incorporated, as appropriate. In its letter, 
reproduced in appendix III, EPA concurred with the results of the report. 
EPA's Water Security Division in the Office of Ground Water and Drinking 
Water also provided technical comments and clarifications that were 
incorporated, as appropriate. 



As agreed with your office, unless you publicly release the contents of this 
report earlier, we plan no further distribution until 30 days from the report 
date. At that time, we will send copies of this report to the appropriate 
congressional committees; interested Members of Congress; the 
Administrator, Environmental Protection Agency; the Secretary, 
Department of Homeland Security; and other interested parties. We will 
also make copies available to others on request. In addition, the report will 
be available at no charge on the GAO Web site at http://www.gao.gov. 



Recommendation for 
Executive Action 



Agency Comments and 
Our Evaluation 
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Should you or your staff need further information, please contact me at 
(202) 512-3841 or stephensonj@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. GAO staff who made major contributions to this report are 
listed in appendix IV. 

Sincerely yours, 




John B. Stephenson 
Director, Natural Resources 
and Environment 
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Appendix I 



Scope and Methodology 



To identify federal statutory authorities and directives that govern 
protection of wastewater treatment facilities, we reviewed applicable laws, 
Homeland Security Presidential Directives, and policies, guidance, and 
regulations related to wastewater security from the Environmental 
Protection Agency (EPA) and the Department of Homeland Security 
(DHS). In addition, we interviewed officials in EPAs Water Security 
Division, as well as DHS officials in various areas of the agency. In addition, 
we spoke with representatives for wastewater industry associations with 
which EPA has collaborated to actively assist wastewater treatment 
facilities to address their security issues. 

To determine the steps critical wastewater treatment facilities have taken 
since 9/11 to address potential vulnerabilities, we conducted a Web-based 
survey of the nation's largest wastewater treatment facilities. For the 
purpose of this review, we defined "critical wastewater facilities" as the 253 
wastewater facilities in the United States that have service area 
populations of 100,000 or greater, as identified in the results of EPAs 2004 
Clean Watershed Needs Survey. 1 As a result of Hurricane Katrina, one 
facility in our initial population of 253 facilities that was identified as a New 
Orleans facility was omitted, leaving a total 252 facilities in our survey 
population. We drafted the survey in consultation with our own survey 
professionals. In addition, we solicited the review and comment of 
knowledgeable officials from the National Academy of Sciences, the Water 
Environment Federation, and the National Association of Clean Water 
Agencies, as well as several wastewater security experts identified in our 
January 2005 report on wastewater security. 2 We conducted seven pretests 
to check that (1) the questions were clear and unambiguous, (2) 
terminology was used correctly, (3) the information was feasible to obtain, 
and (4) the survey was comprehensive and unbiased. The pretest sites were 
chosen to include facilities representing different geographic regions, and 
utilities both with single and multiple facilities. One pretest was done in 
person and six were done over the phone. 

Our survey asked wastewater treatment facility representatives to provide 
a variety of information, such as whether their facilities had conducted 
security assessments; what measures, if any, they had taken or were 



'EPAs Office of Wastewater Management conducts the Clean Watershed Needs Survey 
(CWNS) on aperiodic basis. The CWNS, a joint effort between states and EPA, is conducted 
in response to Section 205(a) and 516 of the Clean Water Act. 

2 GAO-05-165. 
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Scope and Methodology 



planning to take in several security areas; and their perspectives on what 
role the federal government should assume in wastewater treatment 
facility security The survey was made available between October 1, 2005, 
and January 15, 2006, and a unique user identification number and a 
password were provided to each surveyed facility. Three e-mail reminders 
were sent out to nonresponders, and then follow-up phone calls were made 
to all nonresponding facilities. A total of 206 of 252 wastewater treatment 
facilities responded to the survey, resulting in an 82 percent survey 
response rate. Other wastewater facilities that did not respond to the 
survey generally cited security concerns related to providing potentially 
sensitive information or a general policy of not answering surveys. 

Because this was not a sample survey, there are no sampling errors. 
However, the practical difficulties of conducting any survey may introduce 
errors, commonly referred to as non-sampling errors. For example, 
difficulties in how a particular question is interpreted or in the sources of 
information that are available to respondents can introduce unwanted 
variability into the survey results. We took steps both at the data collection 
and at the analysis phases to minimize these non-sampling errors. Since 
this was a Web-based survey, respondents entered their answers directly 
into the electronic questionnaire, which removes one source of error. When 
the data were analyzed, a second, independent analyst checked all relevant 
computer programs. 

To determine what steps EPA and DHS have taken to help wastewater 
facilities in their efforts to address vulnerabilities, we took several 
approaches. First, through semi-structured interviews with agency officials 
and industry association representatives, as well as document reviews, we 
researched various programs that EPA and DHS have under way. Second, 
we identified programs that require cross-agency collaboration between 
EPA and DHS, and we examined in depth those that wastewater treatment 
facility representatives identified as potentially useful. We also interviewed 
state and local officials with oversight for wastewater treatment operations 
and security. Third, one section of our survey gathered information about 
facility representatives' experiences with, perspectives on, and 
expectations for, the federal role in wastewater treatment facility security. 
Responses to open-ended questions were categorized and tallied to analyze 
their content for subsequent research findings. Finally, to develop 
conclusions about the level of coordination between the two agencies in 
the implementation of these programs, we interviewed agency officials 
about their perspectives on how well the agencies are working together. 
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Survey of Wastewater Treatment Facilities 



Survey of Wastewater Treatment 
Facilities 

U.S. Government Accountability Office 

Introduction 

Welcome to the Survey of Wastewater Treatment Facilities. 

The U.S. Government Accountability Office (GAO), a congressional audit 
and evaluation agency, is conducting this survey to identify actions 
wastewater treatment facilities have taken to protect their operations and 
infrastructures from terrorism or other threats. 

Why you are receiving this information: 

The GAO is surveying wastewater treatment facilities that serve residential 
populations of 100,000 or greater. An EPA database identified you as the 
point of contact for your wastewater treatment utility/authority. As a result, 
we are requesting that you or your designated representative complete the 
survey. 

Please complete this survey within two weeks of receipt. We understand that 
there are great demands on your time. However, your participation in our 
study is essential for us to provide relevant information to Congress about the 
actions wastewater treatment facilities have taken to protect their operations 
from terrorism or other security threats. We greatly appreciate your time and 
effort in completing this survey. 

Your responses will be gathered on a SECURED SERVER AND 
AGGREGATED WITH THOSE OF OTHER FACILITIES. They will be 
presented in a report to the Congress IN A SUMMARY FORM ONLY. GAO 
WILL NOT RELEASE INDIVIDUALLY IDENTIFIABLE DATA FROM 
THIS SURVEY, unless compelled by law or required to do so by the U.S. 
Congress. 



Note: The number of survey respondents that answered each question varies based 
on skip instructions; some respondents were directed to answer certain survey 
questions and not others based on their earlier responses. 
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1. About Your Utility 

1 . What is the name of the wastewater treatment utility/authority that is responsible for 
the facility or facilities for which you are completing a survey(s)? (Click in the box 
and enter the name.) 

I 

2. Does your utility/authority manage BOTH drinking water and wastewater treatment? 
Check only one answer. 

N = 206 

1. C Yes [99] 

2. □ No [99] 

3. □ Don't know/No response [8] 

3. How many wastewater treatment facilities within your utility/authority serve 
populations of 100,000 or more? 



Check only one answer. 



N = 206 




l. b 


1 [98] 


2. O 


2 [47] 


3. C 


3 [17] 


4. O 


4 [13] 


5- C 


5 [2] 


6. C 


6 or more (Please specify number below.) [21] 


7- C 


Don't know/No response [8] 



4. (If you checked "6 or more" above) What is the number of wastewater treatment 
facilities within your utility/authority that serve populations of 100,000 or more? 
(Click in the box and enter 1 or 2-digit whole number.) 
N = 26 



[6] 

3 [1] 

8 [10] 

14 [9] 
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2. About Your Facility 

5. What is the size of the service area population served by your wastewater treatment 
FACILITY under regular operating conditions? 

Check only one answer. 
N = 206 

1. C Less than 100,000 [13]* 



2. 


□ 


100,000 


-149,999 


[44] 


3. 




150,000 


-199,999 


[27] 


4. 


□ 


200,000 


-249,999 


[29] 


5. 


□ 


250,000 


-299,000 


[11] 


6. 




300,000 


-349,999 


[15] 


7. 




350,000 


-499,999 


[12] 


8. 


l; 


500,000 


-649,999 


[29] 


9. 


□ 


650,000 


-949,999 


[13] 



10. □ 1,000,000-1,499,999 [1] 

11. C 1,500,000 or more [6] 

12. Don't know/No response [6] 

*These facilities were identified in the results of EPA's 2004 Clean 
Watershed Needs Survey as having service area populations of 
100,000 or over and were kept in our survey. 
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3. Vulnerability/Security Assessments 

6. Has a vulnerability assessment been completed for your wastewater treatment 
facility? 

Check only one answer. 
N = 206 

1. □ Yes (GO TO QUESTION 8.) 1801 

2. C Currently underway (GO TO QUESTION 8.) 1261 

3. C No [89] 

4. ^ Don't know/No response [11] 

7. Has a security or risk assessment been completed for your wastewater treatment 
facility? 

Check only one answer. 
N = 100 
1.0 Yes [21] 

2. O Currently underway [1] 

3. □ No (GO TO QUESTION 17.) [661 

4. □ Don't know/No response (GO TO QUESTION 17.) [121 

8. When was your vulnerability/security assessment completed or most recently 
updated, or when is it scheduled to be completed or updated? 

N = 108 

Responses ranged from April 2001 to July 2006. Most indicated assessments 
were completed, updated, or scheduled to be completed or updated in 2003. 
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9. Were the following factors important in deciding to conduct this 




vulnerability/security assessment for your facility? 






("'Vipflf ntif* in parh row 

V^llWwIV W11V 111 V- CI w 11 1 \J V V a 








N = 128 










Yes 


No 


Don't know/No 
response 


a. Required by state government 


Li 


□ 


E 




Y = 13 


N = 93 


DK/NR = 22 


b. Required by local government or 


C 

X —14 


c 

N = 96 


c 

DK/NR =18 


local government body 


c. Required by utility governing 


c 


c 


c 


body 


Y=19 


N = 91 


DK/NR =18 


d. Required by facility insurance 


E 


□ 


E 


carrier 


Y=2 


N = 102 


DK/NR =24 


e. Conducted assessment of 








wastewater treatment facility in 


C 

Y=35 


□ 


□ 

DK/NR =18 


conjunction with assessment for 
drinking water facility, as required 


N = 75 


by the Bioterrorism Act 








f. Conducted assessment in 








conjunction with facility upgrade 
and/or expansion 


E 

Y=20 


E 

N = 86 


E 

DK/NR =22 


g. Conducted assessment on facility's 


c 


E 


E 


own initiative 


Y=98 


N = 16 


DK/NR =14 


10. What other factors, if any, were important in deciding to conduct this 


vulnerability/security assessment at your facility? 


(Click in the box and enter your 


response. Leave blank if all important factors are 


listed above.) 




N = 49 








We did not summarize the narrative responses to this question for inclusion in 


this appendix. 
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11. Who conducted or is conducting the vulnerability/security assessment for your 
wastewater treatment facility? 



Check one in each row. 
N = 128 



a. Wastewater utility staff 

b. Consultant 

c. City or county staff 

d. Manufacturer's representatives 
(e.g. alarm company personnel) 

e. Other (Please specify in 12 
below.) 



Yes 

c 

Y = 99 

c 

Y = 64 

c 

Y=36 
□ 

Y=7 
C 

Y=19 



No 

c 

N = ll 

c 

N = 46 

c 

N = 57 

E 
N = 81 

□ 
N = 69 



Don't 
know/No 
response 

c 

DK/NR =18 

c 

DK/NR =18 

c 

DK/NR = 35 
□ 

DK/NR =40 

□ 

DK/NR = 40 



12. (If you checked yes for "Other" in 1 1) Who else is involved in conducting the 
vulnerability/security assessment at your facility? 
N = 23 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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Survey of Wastewater Treatment Facilities 



13. What vulnerability/security assessment tool, if any, did your wastewater facility 
use? 



Check one in each row. 
N = 128 



a. Vulnerability Self-Assessment 
Tool (VSAT) 

b. Risk Assessment Methodology 
for Water (RAM-W, developed 
by Sandia National Laboratories) 

c. Security Emergency 
Management System (SEMS, 
developed by the National Rural 
Water Association) 

d. County or city developed its own 
assessment method 

e. Utility developed its own 
assessment method 

f. No tool used 

g. Other (Please specify below.) 



Yes 
G 

Y=54 

c 

Y=26 

g 

Y = 4 

□ 
Y=10 

c 

Y=14 

G 

Y=18 

G 

Y = 26 



No 



N = 40 



N = 67 



N = 76 



N = 77 

G 
N = 74 

G 
N = 57 

G 
N = 55 



Don't know/No 
response 

G 

DK/NR = 34 
G 

DK/NR = 35 
G 

DK/NR = 48 
G 

DK/NR = 41 
G 

DK/NR = 40 

G 

DK/NR = 53 
G 

DK/NR = 47 



14. (If "Other") What other vulnerability/security assessment tool did your wastewater 
facility use? 
N = 30 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

15. As a result of the vulnerability/security assessment, what were the 3 most significant 
measures (activities, changes and improvements) that have been completed to improve 
security at your wastewater treatment facility? 
N = 109 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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Survey of Wastewater Treatment Facilities 



16. In which of the following time frames, if any, do you plan to update your 
vulnerability/security assessment? 

Check only one answer. 
N = 128 



1. 


U 


No plans to update (GO TO QUESTION 27.) [121 


2. 




Continuous process (GO TO QUESTION 27.) [471 


3. 


u 


In about 1 year (GO TO QUESTION 27.) [131 


4. 


u 


In about 2 years (GO TO QUESTION 27.) 171 


5. 


iz 


In about 3 years (GO TO QUESTION 27.) 121 


6. 


u 


In the next 4 years or more (GO TO QUESTION 27.) [01 


7. 


u 


Plan to update, but no time frame set (GO TO OUESTION 27.) 






[36] 


8. 


u 


Don't know/No response (GO TO OUESTION 27.) [Ill 



End of questions for facilities that completed vulnerability assessments/security 
assessments. GOTO QUESTION 27. 

17. Does your facility plan to conduct a vulnerability/security assessment? 
Check only one answer. 
N = 78 

1. B Yes (GO TO OUESTION 20.) [24] 

2. C No [23] 

3. B Don't know/No response [31] 
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18. Were the following factors important in your wastewater treatment facility's 
decision NOT to conduct a vulnerability/security assessment? 

Check one in each row. 



N = 23 



a. Steps we have taken are adequate 
for our security needs 

b. Facility and system are not 
considered terrorist targets 

c. Other priorities and limited 
resources 

d. Emergency response plan was 
updated, and this seemed sufficient to 
address potential vulnerabilities 

f. Not required to do so 



Yes 



No 



Don't know/No 
response 



= 6 



c 






C 


Y=15 


N = 


2 


DK/NR 


C 


□ 




c 


Y = 8 


N = 


8 


DK/NR 


□ 


□ 




G 


Y=ll 


N = 


7 


DK/NR 


D 


□ 




n 


Y = 13 


N = 


5 


DK/NR 


C 


□ 




c 


Y=17 


N = 


3 


DK/NR 



= 5 



= 5 



= 3 



19. What OTHER factors, if any, were important in deciding NOT to conduct a 
vulnerability/security assessment? 
N = 7 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

End of questions for facilities that have decided NOT to complete vulnerability 
assessments/security assessments. Click on GO TO QUESTION 30. 



20. When is your facility's vulnerability/security assessment scheduled to be completed? 
N = 15 

Responses ranged from November 2005 to December 2007. Most facilities 
indicated assessments were scheduled to be completed in 2006. 
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2 1 . Were the following factors important in deciding to conduct this 
vulnerability/security assessment at your facility? 

Check one in each row. 
N = 24 



a. Required by state government 

b. Required by local government or 
local government body 

c. Required by utility governing 
body 

d. Required by facility insurance 
carrier 

e. Conducted assessment of 
wastewater treatment facility in 
conjunction with assessment for 
drinking water facility, as 
required by the Bioterrorism Act 

f. Conducted assessment in 
conjunction with facility upgrade 
and/or expansion 

g. Conducted assessment on 
facility's own initiative 



Yes 



No 



Don't 
know/No 
response 



Y = 2 


N = 


15 


DK/NR 


□ 


c 




D 


Y = 2 


N = 


14 


DK/NR 


c 


□ 




□ 


Y = 2 


N = 


14 


DK/NR 


c 


□ 




□ 


Y = l 


N = 


16 


DK/NR 


c 


□ 




□ 


Y = l 


N = 


17 


DK/NR 


G 

Y = l 


c 

N = 


17 


C 
DK/NR 


c 


c 




c 


Y = 21 


N = 


2 


DK/NR 



22. What OTHER factors, if any, were important in deciding to conduct this 
vulnerability/security assessment at your facility? 
\ - 4 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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23. Who will conduct the vulnerability/security assessment for your wastewater 
treatment facility? 



Check one in each row. 
N = 24 



a. Wastewater utility staff 

b. Consultant 

c. City or county staff 

d. Manufacturer's representatives 
(e.g. alarm company personnel) 

e. Other (Please specify below.) 



Yes 


No 


D 


G 


Y = 17 


N = 2 


G 


c 


Y = 9 


N = 8 


D 


G 


Y = 8 


N = 11 


C 


C 


Y = 


N = 15 


c 


u 


Y = 


N = 14 



Don't know/No 
response 

G 

DK/NR = 5 

G 

DK/NR = 7 

u 

DK/NR = 5 

c 

DK/NR = 9 
G 

DK/NR = 10 



24. (If "Other") Who else will be involved in conducting the vulnerability/security 
assessment at your facility? 
N = 
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25. What vulnerability/security assessment tool, if any, did your wastewater facility 


use? 








Check one in each row. 








N = 24 














Don't 




Yes 


No 


know/No 








response 


Q \/i 1 1 rl f*¥C\ rvil ft~\r VfMT A CCPCCrMPtlt 
a. V LL111CI dUlllLy OCll-rtaaCaMllClll 




r t 

Lj 


y 


Tool (VSAT) 


Y = 15 


N = 3 


DK/NR =6 


b. Risk Assessment Methodology 








for Water (RAM-W, developed 


C 


D 


D 


by Sandia National 


Y = l 


N= 12 


DK/NR =11 


Laboratories) 








c. Security Emergency 








Management System (SEMS, 


c 


O 


□ 


developed by the National Rural 


Y = 


N = 13 


DK/NR =11 


Water Association) 








d. County or city developed its own 





C 


□ 


assessment method 


Y = 


N = 14 


DK/NR = 10 


e. Utility developed its own 


E 


c 


□ 


assessment method 


Y = 


N = 14 


DK/NR = 10 


f. No tool used 


c 


D 


D 




Y = 2 


N= 13 


DK/NR = 9 


g. Other^/eaie specify below.) 


c 


E 


D 




Y = 3 


N = 10 


DK/NR =11 


26. (If "Other") What other vulnerability/security assessment tool will your wastewater 


facility use? 








N = 3 








We did not summarize the narrative responses to this question for inclusion in 


this appendix. 
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4. Chemical Security Measures 

27. Does your wastewater treatment facility use gaseous chlorine to disinfect 
wastewater? 

Check only one answer. 
N = 206 

1. □ Yes (GO TO QUESTION 32.) |851 

2. O No [116] 

3. □ No answer [5] 

28. Did your wastewater treatment facility EVER use gaseous chlorine to disinfect 
wastewater? 

Check only one answer. 
N = 121 

1. C Yes [79] 

2. □ No (GO TO QUESTION 31.) [34] 

3. □ Don't know/No response (GO TO QUESTION 31.) [8] 

29. When did your wastewater treatment facility decide to discontinue its use of 
gaseous chlorine? 

Check only one answer. 
N = 55 

Responses ranged from July 1980 to October 2005. Many facilities made the 
decision to discontinue the use of gaseous chlorine between 1998 and 2001. 

30. How have ANNUAL (as opposed to capital) costs at your wastewater treatment 
facility been affected by converting to an alternative disinfection process? 

Check only one answer. 
N = 79 

1. £j Costs have increased [58] 

2. $2 Costs have stayed about the same [11] 

3. Costs have decreased [1] 

4. ^ Don't know/No response [9] 



Page 45 



GAO-06-390 Wastewater Facility Security 



Appendix II 

Survey of Wastewater Treatment Facilities 



3 1 . What disinfection method does your wastewater treatment facility use? 

Check only one answer. 
N = 121 

1 . C Sodium hypochlorite (transported to site) (GO TO QUESTION 

40.) [871 

2. ^ Sodium hypochlorite (generated onsite) (GO TO QUESTION 40.) 

[2] 

3. C Calcium hypochlorite (GO TO QUESTION 40.) [0] 

4. □ Ozone (GO TO QUESTION 40.) [0] 

5. □ Ultraviolet light (GO TO QUESTION 40.) [17] 

6. O Other (GO TO QUESTION 40.) [3] 

7. U Don't know/No response (GO TO QUESTION 40.) [12] 

End of questions for facilities that do not use gaseous chlorine. GO TO 
QUESTION 40. 



32. How is the chlorine transported and stored? 
Check only one answer. 
N = 85 



1. c 


In 50 - 100 pound cylinders [0] 


2- C 


In 150-pound cylinders [3] 


3. C 


In one-ton containers [59] 


4. C 


In 17-ton tractor trailers [6] 


5.C 


In 91-ton rail cars [9] 


6. C 


Other {Please specify number below.) [7] 


7. c 


Don't know/No response [1] 



33. (If "Other") By what other method is the chlorine transported and stored? 
N = 8 

We did not summarize the narrative responses to this question for inclusion 
in this appendix. 
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34. Which one of the following changes, if any, has your wastewater treatment facility 
made in how it stores and uses gaseous chlorine and when did it make them? 

Check one in each row. 
N = 85 



a. Converted chlorine to 
smaller quantity alternative 

b. Instituted controls for 
selective access to chlorine 
storage areas 

c. Installed electronic 
surveillance and detection 
of chlorine storage areas 

d. Made other physical 
security improvements to 
the gaseous chlorine storage 
area 



Before 


After 


No 


Don't 


September 


September 


change 


know/No 


11, 2001 


11,2001 


made 


response 


c 


c 


c 


c 


4 


3 


70 


8 


u 


u 


□ 


□ 


14 


41 


24 


6 


□ 




□ 




21 


30 


27 


7 


□ 


L3 


□ 




7 


30 


39 


9 



35. (If you indicated "Yes" for "Made other physical security improvements" above) 
What other physical security improvements to the gaseous chlorine storage area did 
your facility make? 

N = 35 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

36. Does your wastewater treatment facility PLAN to stop using gaseous chlorine? 
Check only one answer. 

N = 85 

1. O Yes [20] 

2. ^ No (GO TO QUESTION 40.) [53] 

3. O Don't know/No response (GO TO QUESTION 40.) [12] 

37. When does your wastewater treatment facility PLAN to stop using gaseous chlorine? 
N = 14 

Responses ranged from November 2005 to January 2015. Most indicated that 
their facilities planned to discontinue their use of gaseous chlorine in 2006 and 
2007. 
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38. How do you expect ANNUAL (as opposed to capital) costs at your wastewater 
treatment facility to be affected by converting to an alternative disinfection 
process? 

Check only one answer. 
N = 20 

1. □ Costs will increase [17] 

2. £2 Costs will stay about the same [1] 

3. Costs will decrease [1] 

4. 12 Don't know/No response [1] 

39. What disinfection method does your wastewater treatment facility plan to use? 
Check only one answer. 



N = 


20 




1. 




Sodium hypochlorite (transported to site) [10] 


2. 




Sodium hypochlorite (generated onsite) [1] 


3. 


□ 


Calcium hypochlorite [0] 


4. 


□ 


Ozone [0] 


5 




Ultraviolet light [9] 


6 


□ 


Other [0] 


7. 




Don't know/No response [0] 



40. What OTHER chemicals, if any, are currently at your wastewater treatment facility, 
or will be in the future, that have the potential to cause significant harm and damage 
if used for terrorist activity? 
N = 128 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

41. For each chemical identified in 40, if any, please indicate its use at your 
wastewater treatment facility. 
N = 103 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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5. Physical Security Measures 










42 


For each of the following physical security measures that your wastewater 




treatment facility may have, was 


it completed before September 11, 2001, 




completed after September 11, 2001, is it planned but not yet completed, or is it 




NOT planned? 














Check one in each row. 












N = 206 


Completed 


Completed 












BEFORE 


AFTER 


Planned, 




Don't 






September 11, 


September 


not yet 


NOT 


know/No 






2001 


11,2001 


completed planned 


response 


a. 


Guard stations 


□ 
37 


□ 

33 


g 

6 


G 
115 


c 

15 


b. 


Vehicle gates 


□ 


□ 


g 


□ 


C 






149 


35 


6 


3 


13 


c. 


Security fences 


□ 


G 


g 


□ 


□ 






174 


11 


7 


3 


11 


d. 


Safeguards for 
on-site delivery 


□ 


□ 


g 


□ 


G 




of materials to 


84 


54 


15 


35 


18 




the facility 












e. 


Additional site 
lighting 


□ 
79 


□ 

33 


g 

34 


c 

47 


D 

13 


f. 


Motion 




□ 

20 










detectors 


□ 
15 


g 

33 


c 

121 


G 
17 


g- 


Visual 

surveillance 

monitoring 


□ 
55 


□ 
60 


g 

51 


□ 

28 


G 

12 


h. 


Redundant 
power sources 


□ 


□ 


g 


□ 


G 




160 


14 


12 


8 


12 
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i. Sensors to 
detect toxics and 
other 

biochemical 
threats to the 
operation (e.g. 
smart pipes) 

j. Lower 

explosive level 
(LEL) meters or 
other gas 
detection devices 

k. Intrusion alarms 
Before 9/11 =67 

1. Manhole 

intrusion sensors 

m. Manhole locks 

n. Redundant 
pumping devices 
or collection 
bypass systems 



Completed 
BEFORE 
September 11, 
2001 



□ 

39 



c 

149 

c 

67 

□ 
2 

□ 
24 

E 
133 



Completed 

AFTER Planned, Don't 
September not yet NOT know/No 

11, 2001 completed planned response 



□ 


□ 


c 


u 


1 


8 


139 


19 


□ 


□ 


□ 




8 


4 


27 


18 


□ 


□ 


□ 


c 


21 


31 


72 


15 


□ 


□ 


c 


u 





7 


173 


24 


□ 


□ 


c 


u 


6 


11 


141 


24 


□ 


□ 


□ 


zz 


2 


11 


39 


21 



43. What OTHER physical security improvements, that you consider significant, have 
been installed or are planned for your wastewater treatment facility and associated 
infrastructure? Be sure to include any specific changes that your wastewater 
facility has made to improve physical security in your COLLECTION SYSTEM, if 
they are not listed above. 
N = 72 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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6. Personnel Security Measures 






44. For each of the followine personnel security measures that vour wastewater 


treatment facility may have, if any, was it completed before September 11, 2001, 


completed after September 1 1 , 200 1 , is it planned but not yet completed, or is it 


NOT planned? 








Check one in each row. 






N = 206 










Completed 


Completed 






BEFORE 


AFTER 


Planned, Don't 




September 


September 


not yet INCH know/iNo 




11, 2001 


11, 2001 


completed planned response 


a. Facility maintains 








an up-to-date list of 








all employees, their 


c 


r 1 
Lj 


IT* IT" 1 F°" 
Li Lj Lj 


phone numbers and 


179 


7 


20 


emergency contact 








information 








b. Background 








checks are 


u 


□ 


coo 


performed on new 


94 


23 


15 40 34 


employees 








c. All employees are 








issued and required 


c 


□ 


o o o 


to display photo- 


84 


60 


1 ft io ** A 

10 28 24 


identification 








d. Employees have 








access to and use 








communications 








equipment when 


c 


□ 


o o o 


working away from 


163 




7 6 24 


the administrative 


6 


setting on site or 








when working off- 








site 








e. Non-utility 








personnel 








(contractors, 


□ 


□ 


o o o 


vendors, and 








visitors, etc.) are 


46 


80 


14 39 27 


required to show 








identification 
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f. Non-utility 
personnel 
(contractors, 
vendors, and 
visitors, etc.) may 
access the facility 
only with an escort 

g. Periodic training 
is provided on 
procedures for 
responding to events 
and incidents and 
other security-related 
issues 



Completed 
BEFORE 
September 
11,2001 



33 



c 

105 



Completed 
AFTER 

September 
11, 2001 



u 

50 



c 

36 



Planned, 
not yet 
completed 



13 



29 



Don't 
NOT know/No 
planned response 



85 



13 



25 



23 



45. What OTHER personnel security improvements, that you consider significant, have 
been installed or are planned for your wastewater treatment facility and associated 
infrastructure? 
N = 41 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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7. Information Technology (IT) Security Measures 






46. For each of the following 


Information Technology (IT) security measures that your 


wastewater treatment facility may have, 


was it completed before September 1 1 , 




2001, completed after September 11, 2001, is it planned but not yet completed, 


or is 


it NOT planned? 












Check one in each row. 












N = 206 














Completed 


Completed 










BEFORE 


AFTER 


Planned, 




Don't 




September 


September 


not yet 


NOT know/No 




11,2001 


11, 2001 


completed 


planned response 


a. Virus protection 


c 


□ 


□ 


□ 


□ 


program 


1 z# 


1 


1 8 


2 


27 


b. Network protection, 












such as a firewall, an 


c 


□ 


u 


□ 


E 


intrusion detection 


149 


24 


3 


3 


27 


system, and monitoring 












c. Backup power supply 


c 


□ 




□ 


C 




168 


10 


1 


3 


24 


d. SCADA system 












protections, such as 












hardening of the system 












against potential 


u 


□ 


c 


□ 


E 


intruders and periodic 


93 


36 


25 


22 


30 


identification and 












backup to off-site 












facility 












e. Upgrading SCADA 












system: Periodic 












identification and 












backup of operational- 


EJ 


□ 


EJ 


□ 


C 


critical applications and 


84 


28 


29 


33 


32 


databases to an off-site 












facility 












47. What OTHER IT security improvements, that you consider significant, have been 


installed or are planned for your wastewater treatment facility and associated 




infrastructure? 












N = 45 












We did not summarize the narrative responses to this question for inclusion in 


this appendix. 
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8. Coordination Activities 

48. Does your facility have a designated individual to oversee internal security initiatives 
at your wastewater treatment facility? 

Check only one answer. 
N = 206 

1. C Yes [131] 

2. B No (GO TO QUESTION 50.) [651 

3. B Don't know/No response (GO TO QUESTION 50.) [101 



49. Does this person oversee efforts to address security that require coordination with 
other organizations and governments? 

Check only one answer. 
N = 131 

1. □ Yes [110] 

2. C No [18] 

3. B Don't know/No response [3] 

50. Does your wastewater treatment facility have periodic (annually, semi annually or 
more often) contact about security planning with the following? 

Check one in each row. 
N = 206 

Don't 





Yes 


No 


know/No 
response 


a. Nearby utilities 


c 


□ 


D 




Y = 103 


N = 86 


DK/NR=17 


b. Police and fire departments 


c 


□ 


D 




Y = 150 


N = 43 


DK/NR = 13 


c. Public health community 


D 


□ 


D 




Y = 99 


N = 83 


DK/NR = 24 


d. Local Emergency Planning 


c 


C 


c 


Committee (LEPC) 


Y = 130 


N = 53 


DK/NR = 23 
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Don't 




Yes 


No 


know/No 








response 


e. Industry organizations, e.g. Water 








Environment Federation (WEF), National 


D 


D 


□ 


Association of Clean Water Agencies 


Y = 140 


N = 50 


DK/NR = 16 


(NACWA) 








f. Individual industrial/commercial facilities 


c 


C 


c 


in service area 


Y = 68 


N = 112 


DK/NR = 26 


g. Hazardous material storage facilities 


c 


c 


c 


located in service area 


Y = 65 


N = 109 


DK/NR = 32 


h. State organizations and agencies with 








oversight for wastewater operations and 


c 


□ 


□ 


security {Please specify below.) 


Y = 99 


N = 85 


DK/NR = 22 


i. Federal organizations and agencies with 








oversight for wastewater operations and 


E 


□ 


□ 


security {Please specify below.) 


Y = 80 


N = 99 


DK/NR = 27 


51. (If you indicated "yes" for "State organizations and agencies 


' above) Which state 


organizations and agencies with oversight for wastewater operations and security does 


your facility have periodic contact about security planning? 






N = 101 








We did not summarize the narrative responses to this question for inclusion in 


this appendix. 








(If you indicated "yes" for "Federal organizations and agencies" above) Which federal 


52. organizations and agencies with oversight for wastewater operations and security does 


your facility have periodic contact about security planning 






N = 77 








We did not summarize the narrative responses to this question for inclusion in 


this appendix. 









Page 55 



GAO-06-390 Wastewater Facility Security 



Appendix II 

Survey of Wastewater Treatment Facilities 



53. Which of the following security coordination activities has your wastewater 


treatment facility implemented or participated in? 






Check one in each row. 








N = 206 










Yes 


No 


Don't know/No 
response 




a. Identified all counties, cities, and 








police and fire departments with 


C 


C 


c 


jurisdiction in the area where the 


Y = 171 


N = 23 


DK/NR = 12 


wastewater system assets are located 








b. Identified all locations in service 








area at which hazardous materials are 


C 


c 


c 


manufactured, used, or stored in 


Y = 105 


N = 72 


DK/NR = 29 


significant quantities 








c. Required all hazardous material 








storage locations to develop and 


B 


□ 


□ 


implement Spill Prevention, Control 




and Countermeasure (SPCC) Plans and 


Y = 127 


N = 44 


DK/NR = 35 


containment facilities 








d. Evaluated SPCC Plans for adequacy 


E 


r i 


IT" 1 


in preventing unauthorized access to 


Y = 115 


La- 

N = 49 


Lai 


and release of hazardous materials 


DK/NR = 42 


e. Inspected all hazardous material 


C 


c 


c 


storage locations to verify adequacy of 


SPCC Plans and containment facilities 


Y = 118 


N = 48 


DK/NR = 40 


f. Addressed identified SPCC Plan and 


E 


E 


E 


containment facility deficiencies 


Y = 115 


N = 49 


DK/NR = 42 


g. Meet with LEPC, provide 








information about operations and 








systems, and provide maps of critical 


C 


c 


c 


infrastructure and hazardous 


Y = 98 


N = 66 


DK/NR = 42 


materials storage locations in service 








area. 








h. Give facility tours to police and 


c 


C 


c 


fire personnel 


Y = 171 


N = 19 


DK/NR = 16 


i. Developed a response plan with 


C 


c 


c 


staff 


Y = 181 


N = 12 


DK/NR = 13 


j. Developed or participate in a joint 


C 


c 


c 


response plan with community 


agencies, groups, or associations 


Y = 108 


N = 62 


DK/NR = 36 
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k. Developed an emergency notification 
protocol for staff 

1. Participate in an emergency 
notification protocol for customers 
and hazardous materials storage 
facilities in service area, with 
emphasis on neighbors 

m. Participated in a security tabletop 
exercise 

n. Established a communication 
network 

o. Developed training materials 

p. Created or are part of a mutual aid 
resource list 

q. Met with FBI Field Office to 
discuss protocols and other security 
measures 



Yes 

c 

Y = 186 



Y = 70 

G 

Y = 83 

G 

Y = 159 

□ 

Y = 141 

□ 

Y = 108 

D 

Y = 51 



No 

c 

N = 9 
G 

N = 99 

c 

N = 98 

c 

N = 29 

c 

N = 44 

c 

N = 72 

G 
N = 128 



Don't know/No 
response 

c 

DK/NR=11 



DK/NR = 37 

c 

DK/NR = 25 

c 

DK/NR =18 

c 

DK/NR = 21 

□ 

DK/NR = 26 

G 

DK/NR = 27 



54. What role, if any, do you think the federal government should play in 

COORDINATING security initiatives at wastewater treatment facilities and their 
associated infrastructures? 
N = 125 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 



Page 57 



GAO-06-390 Wastewater Facility Security 



Appendix II 

Survey of Wastewater Treatment Facilities 



9. Conclusions and Additional Comments 

55. What are the 3 most significant security measures that have been put in place at your 
wastewater treatment facility and associated infrastructure? 

N = 177 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

56. Of those security measures that you have PLANNED, BUT HAVE NOT YET PUT 
IN PLACE, which 3 measures do you anticipate will be the most useful to improving 
security at your wastewater treatment facility and associated infrastructure? 

N = 147 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

57. What 3 security measures, if any, would you put in place if you were free to 
implement any measures you viewed as potentially useful to improving security at 
your facility and associated infrastructure 

N = 161 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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58. For the security measures you listed in 57 above, were any of the following factors 
important in your facility not yet implementing these measures? 
(Check one in each row. Leave blank if you did not list any security measures in 57.) 

N = 206 



a. Not enough time 

b. Limited resources 

c. Other security priorities more critical 

d. Technology needed not readily 
available 

e. Necessary agreements not in place 

f. Other {Please specify below. ) 



Yes 



No 



Don't know/No 
response 



c 


u 




c 




Y = 39 


N = 


85 


DK/NR 


=82 


o 


c 









Y = 129 


N = 


13 


DK/NR 


= 64 


c 


c 




u 




Y = 62 


N = 


63 


DK/NR 


= 81 


□ 


□ 




u 




Y = 27 


N = 


94 


DK/NR 


= 85 


□ 


□ 




c 




Y = 23 


N = 


92 


DK/NR 


= 91 


c 


C 




c 




Y = 18 


N = 


52 


DK/NR = 


= 136 



59. (If you checked "yes" for Other) What other factors were important in your facility not 
yet implementing these measures? 
N = 21 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 



60. What do you consider to be the major challenges to reducing vulnerabilities to the 
wastewater treatment collection systems' network of sanitary, storm, and combined 
sewer lines? 
N = 151 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 



61. What, if any, are the most innovative or effective practices that address these 

challenges to reducing vulnerabilities to the wastewater treatment collection system? 
N = 109 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 
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62. What are the most important things, if any, the federal government could do to 
improve the security at your facility and other wastewater treatment facilities 
nationwide? 

N = 143 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

63. If you would like to provide additional comments concerning security at your 
wastewater treatment facility, specifically, and/or security at wastewater treatment 
facilities in general, please provide them in the space below. 

N = 40 

We did not summarize the narrative responses to this question for inclusion in 
this appendix. 

64. Have you finished this questionnaire? 

Check only one answer. 
N= 206 

1.0 Yes [206] 

2. O No [0] 



Page 60 



GAO-06-390 Wastewater Facility Security 



Appendix III 



Comments from the Environmental 
Protection Agency 



UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 



HAR 15 2006 

OFFICE OF 
WATER 

Mr. John B. Stephenson 

Director, Natural Resources and the Environment 
Government Accountability Office 
Washington, DC 20548 

Dear Mr. Stajhenson: 

Thank you for the opportunity to review the draft Government Accountability Office 
(GAO) Report; Security Wastewater Facilities: Utilities Have Made Important Upgrades, 
Though Further Improvements To Key System Components May Be Limited by Costs and Other 
Constraints. We appreciate the information in the report and have already begun to address some 
of the concerns that you raised. Staff members from my program have provided GAO with 
technical comments on the draft under separate cover. 

We all rely on clean, safe, and secure water. Therefore, from a public health and 
economic perspective, it is critical that we protect our nation's wastewater infrastructure. Your 
report recommends that the Environmental Protection Agency (EPA or Agency) work with the 
Department of Homeland Security (DHS) and the Water Sector Coordinating Council to identify 
areas where the Water Information Sharing and Analysis Center (WaterlSAC) and the 
Department of Homeland Security's Homeland Security Information Network (HSTN) could be 
better coordinated, focusing in particular on (1) how operational duplications and overlap could 
be addressed, and (2) how water systems' access to timely security threat information could be 
improved. GAO also recommends that EPA work with DHS and the Water Sector Coordinating 
Council to identify realistic timeframes for the completion of these tasks. 

The results and recommendation of the report are useful, well thought out, and 
demonstrate a well conceived and executed project. The Agency has a number of initiatives 
underway to address GAO's recommendations. EPA continues to encourage the Water Sector 
Coordinating Council to consider how the WaterlSAC and HSTN could be integrated to be more 
useful to the sector. 

The Association of Metropolitan Water Agencies (AMWA) operates the WaterlSAC 
using funding from a directed grant from EPA. The most recent grant agreement included a term 
and condition to evaluate how WaterlSAC and HSIN features might be effectively combined. As 
a result of this task in AMWA's grant agreement, the WaterlSAC is in the process of conducting 
an evaluation of the two systems. Furthermore, the Water Sector Coordinating Council has asked 
AMWA to conduct a similar evaluation of the features of WaterlSAC and HSTN. EPA continues 
to work with DHS and the Water Government Coordinating Council to seek opportunities to 
improve the features of HSIN for eventual adoption by the water sector. 



tntemet Address (URL) • http://www.epa.gov 
Recycled/Recyclable • Printed with Vegetable Oil Based Inks on 100% Postconsumer, Process Chlorine Free Recycled Paper 
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A number of the issues raised in the document will be useful to the Agency as it moves 
forward with the wastewater and drinking water security program. EPA has been designated as 
the Sector Specific Agency for the Water Sector - which covers both drinking water and 
wastewater utilities. To ensure the safety of our nation's drinking water supply and the protection 
of water quality by reducing the risk to public health, the environment, and critical infrastructure, 
the Agency is committed to continuing to collaborate and build upon existing relationships with 
DHS and other parties - including utilities, other critical infrastructure sectors, state, local and 
tribal governments, and stakeholders. This coordination is critical in order to better understand 
interdependencies, develop tools and training, improve information sharing and exchange 
mechanisms, and conduct research activities to ensure that critical infrastructure operations in the 
water sector are not interrupted by potential terrorist or other intentional acts. 

I appreciated the opportunity to coordinate with your staff on this project. Should you 
need additional information or have further questions, please contact me or Cynthia C. 
Dougherty, Director of the Office of Ground Water and Drinking Water at (202) 564-3750. 



Sincerely, 




Benjamin H. Grumbles 
Assistant Administrator 
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GAO Contact John B - Stephenson (202) 512-3841 



AcknOWlGd.gni.GntS * n addition to the contact named above, Nancy Bowser, Jenny Chanley, 

Steve Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry Sandau, 
Rebecca Spithill, and Monica Wolford made key contributions to this 
report. 
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GAO's Mission 



The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 



Obtaining Copies of 
GAO Reports and 
Testimony 



The fastest and easiest way to obtain copies of GAO documents at no cost 
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. To 
have GAO e-mail you a list of newly posted products every afternoon, go to 
www.gao.gov and select "Subscribe to Updates." 



Order by Mail or Phone 



The first copy of each printed report is free. Additional copies are $2 each. 
A check or money order should be made out to the Superintendent of 
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. Orders 
should be sent to: 

U.S. Government Accountability Office 
441 G Street NW, Room LM 
Washington, D.C. 20548 



To order by Phone: 



Voice: (202) 512-6000 
TDD: (202) 512-2537 
Fax: (202)512-6061 



To Report Fraud, 
Waste, and Abuse in 
Federal Programs 



Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 
E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 



Congressional 
Relations 



Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 
U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548 



Public Affairs 



Paul Anderson, Managing Director, AndersonPl@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548 
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